A database containing the details of 33 lakh job seekers, allegedly sourced from employment websites, has emerged as the foundation of one of the more expansive interstate cyber fraud networks Gujarat Cyber Crime Cell has dismantled this year. The arrest of alleged mastermind Lovely alias Sameer alias Ravi Arora, traced to Chennai after two days of technical surveillance and local reconnaissance, has exposed a network spanning fake employment schemes, investment fraud and a cryptocurrency pipeline allegedly running toward Dubai.
Investigators recovered 14 mobile phones, three laptops and multiple SIM cards during Arora’s arrest, devices now under forensic examination for links connecting him to the network’s broader operations. Police say he worked as a financial conduit for a China-linked cybercrime operation, arranging mule bank accounts, routing fraud proceeds and converting collected money into USDT cryptocurrency before it moved overseas.
A Network Mapped Through 34 Bank Accounts
Examination of the seized devices revealed details of 34 bank accounts connected to the alleged racket, accounts that investigators have since linked to 113 separate cybercrime complaints registered across different parts of India, with combined losses estimated at more than ₹33.14 crore. This structure, in which a relatively small cluster of mule accounts can be traced back to complaints filed in numerous, often distant jurisdictions, illustrates how a single financial backbone can service fraud operations that appear entirely unconnected to individual victims and local police stations investigating them in isolation.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
When a Job Application Becomes the Trap
The fake employment scheme at the network’s core exploited a database of 33 lakh job seekers to identify and contact unemployed individuals with offers of work-from-home data-entry positions. Victims were asked to pay approximately ₹5,000 upfront for registration and security deposits, before being assigned tasks through a purported software platform called Care Compass.
Once the assigned work was completed, victims were allegedly told their accuracy fell below the required standard, a pretext used to withhold payments that were never genuinely owed in the first place. Police estimate more than 750 people were defrauded of over ₹3.35 crore through this specific scheme alone, a pattern consistent with a broader trend flagged in the Asia Pacific Group on Money Laundering’s 2026 Cyber Scam Hubs and Human Trafficking Report, which documented how fake recruitment across India has been systematically exploited to harvest not just registration fees but also bank accounts, debit cards and SIM cards later supplied to overseas fraud hubs.
Investment Fraud Added a Second Revenue Stream
Beyond the employment scheme, the network allegedly ran parallel investment fraud operations targeting victims with stock market and dollar-denominated investment opportunities. In one documented case, a trader was added to an investment group and shown substantial fabricated profits on gold-linked investments through a purported trading platform, only to find his withdrawal attempt fail entirely once he tried to access the displayed gains. That single case alone accounted for an estimated ₹1.52 crore in losses, illustrating how the network layered multiple fraud categories to maximise returns from its underlying infrastructure of mule accounts and fake digital platforms.
The path to Arora’s arrest began with four earlier arrests of suspected network members from Ahmedabad, Uttar Pradesh and Rajkot, during which one accused, identified as Shoaib, allegedly provided the crucial lead that pointed investigators toward Arora specifically. Further investigation revealed that Arora, originally from Rohtak in Haryana and a Mumbai resident for roughly eleven years, had travelled to Dubai multiple times and previously operated a website connected to US Forex trading before returning to India following business losses, a background that appears to have positioned him precisely for the cryptocurrency conversion role investigators now allege he played.
Tracing the Pipeline That Led to Dubai
Police suspect Arora’s core function was converting rupee-denominated fraud proceeds into USDT before transferring the cryptocurrency toward Dubai, a laundering method that has become increasingly common across large Indian cyber fraud networks with suspected Chinese operational links, since crypto conversion breaks the traceable banking trail at precisely the point where Indian financial regulators would otherwise be able to intervene.
With Arora in custody, the Gujarat Cyber Crime Cell’s immediate priority is reconstructing the complete money trail across all 34 identified bank accounts, tracing how the job-seeker database was originally obtained and by whom, and identifying the wider circle of call-centre operators, mule-account providers and overseas handlers that investigators believe sustained the network’s operations across multiple states.
